1. Field of the Invention
This invention relates to the arts of securing access to resources (objects) on networked server computers for use by authenticated client computers, and especially to methods and systems which allow for extensions to and grouping of permitted actions to protected objects.
2. Description of the Related Art
Many organizations now value the public Internet and private intranets as effective and vital mediums for global communication. Electronic commerce has rapidly become an essential component of many business marketing strategies. Educational institutions rely on the Internet for long-distance learning. On-line services allow individuals to send electronic mail and to tap the Web's vast encyclopedia of resources. Traditional applications, such as TELNET and POP3, still prevail as important network services.
Businesses want to use the Internet as a global commercial and distribution vehicle, but have been hindered by the lack of proven security policy mechanisms and management systems. A mixture of dissimilar hardware and software usually impacts a network in the following ways:                (a) no centralized control of security for applications;        (b) no unified resource location naming convention;        (c) no common support for high availability of applications; and        (d) no common support for scalable growth.        
New business models require organizations to expose their information resources to a previously unthought of degree. These businesses need to know that they can securely control access to those resources.
Managing security policy and users access rights across distributed networks has proven difficult for Information Technology (IT) managers, especially since individual application and system vendors implement authorization in their own proprietary fashion.
In most computer resource security systems, authorization processes are distinct from authentication processes. Authentication, which is typically performed first, ensures that the individual (or client process) is who he or she claims to be, but determines nothing about his or her specific rights to perform operations on a protected computer resource. Part of the typical authentication process involves the acquisition of a “credential” that describes the identity of the client.
Following authentication, an authorization process determines whether an authenticated user has the right to perform a specific operation on a specific resource in a secure domain. Authorization decisions are typically made based on the user's credentials.
Companies realize that developing new authorization services for each enterprise application is an expensive process that leads to a difficult-to-manage infrastructure. A centralized authorization service that is accessed by developers via a standardized API greatly speeds the time to market, and reduces the total cost of ownership of an application or a system.
In network security parlance, there are several terms commonly in use. For better understanding of the present invention, a definition of some of these terms is presented. A “Secure Domain” is a group of users, systems, and resources that share common services and usually function with a common purpose. An “Access Control List (ACL) policies” are the security mechanisms that provide users the permissions to perform specific operations, or actions on protected resources. “Authentication” is the process of identifying any individual attempting to login to a secure domain, resulting in the generation of user credentials. “Authorization” is the process performed for determining whether an individual user has the right to perform an operation on a protected resource. “Credentials” are detailed information, acquired or generated during authentication, describing the user and other security-related identity attributes. “Protected Object Policy” (“POP”) refers to the security mechanism that dictates special conditions for accessing a protected resource after a successful ACL policy check. A user “registry” is the datasource (LDAP, DCE, or Domino) that maintains account information for users and groups of users who are allowed to participate (use) in the secure domain.
Many of the security management systems use a finite set of permission indicators, such as alphabetic characters, within entries in the policy database or repository to indicate a user's or user group's rights to access and use a protected object to which the policy is attached. This finite set of permission indicators sets a finite limit as to how many protected objects may be controlled using the syntax of the system's policy repository.
Finite limitations of the number of policy permissions in an ACL entry are undesirable facets of a network security management system, which complicates and limits the ability of a security administrator to effectively implement and manage a security plan. Therefore, there is a need in the art for a method to extend the finite number of ACL permissions for security policy management systems.
Further, certain types of actions can be categorized into logical groupings, such as actions commonly needed by Java applications, or actions commonly needed by local administrators. In order to allow more effective management of actions by such categorization, there exists a need in the art for a system and method to define sets of actions into action groups.